What You Don't Know About Merchant Card Processing Can Cost You

1. Treasurers’ Association of Virginia 85th Annual Conference, Harrisonburg, VA June 24, 2015 What You Don’t Know About Merchant Card Processing Can Cost You Presented by: Barbara Fava, Managing Director PFM Asset Management LLC 1 Keystone Plaza, Suite 300 N. Front and Market Streets Harrisburg, PA 17101 (717) 232-2723 favab@pfm.com

2. Merchant Card Process Summary

3. Merchant Card Processors

4. Processing Fees and Rates

5. Interchange Fees • Non-negotiable fee paid to the issuing bank • Same for all issuing banks • Two-part fee: • Percentage of transaction volume • Flat fee per transaction • Example: 1.51% of volume plus $0.10 per transaction • Interchange category is based on details of transaction: • Card brand • Card type • Card category • Processing method • Business Type

6. Merchant Category Codes

7. Interchange Examples • $100 dollar transaction • Visa Credit • Card Not Present transaction 1.54% rate on volume $0.10 per transaction Total Interchange: $1.64

8. Interchange Examples • $100 dollar transaction • Visa Credit Rewards • Card Present transaction 1.65% rate on volume $0.10 per transaction Total Interchange: $1.75

9. Interchange Examples • $100 dollar transaction • MasterCard Credit • Eligible for Interchange Merit III, Processed as Merit 1 Merit III: 1.58% rate $0.10 per transaction Interchange: $1.68 Merit I: 1.89% rate $0.10 per transaction Interchange: $1.99 Difference: $0.31

10. Processing Costs (Assessment Fees) • Non-negotiable fee paid to the card associations (VISA, MasterCard, etc.) • Same for all issuing banks • Includes percentage, a transaction fee, and monthly fees* *Brands may also charge: Kilobyte Access fees, Cross Border or International Assessment fees, and other network and license fees

11. Processing Costs (Markup Fees) • Negotiable fee paid to merchant card processor • Inconsistencies make it difficult to compare credit card processors • Differ significantly by: • Transaction Amount • Pricing model

12. Processing Costs (Summary) • $100 dollar transaction • Eligible for Interchange Category CPS Small Ticket (Swiped) • Card Type: Visa Credit Reward Processed as CPS/Retail Key Entered

13. Pricing Models (Pass-Through) • Interchange and assessment fees are billed directly to the merchant at cost • The same mark-up for every interchange category • Advantages: • Transparent • Allows for interchange optimization • Generally less expensive • Issues to Consider • Processors will add on fees • Costs go up when interchange increases • Best interchange category not always obtained

14. Pass-Through Pricing (Interchange Plus)

15. Pricing Models (Bundled Pricing) • Processor sets fixed fee by “tier” • Example • Qualified (1.69% + $0.25) • Mid-qualified (2.25% + $0.31) • Non-qualified (3.35% + $0.31) • Qualification category based on transaction characteristics • Interchange and assessment rates are not disclosed • Issues to Consider • Lack of transparency • Generally results in highest processing costs • No interchange optimization • Allows processor to keep refunds “Bundled Pricing has played a big role in building the processing industry’s shady reputation” www.cardfellow.com

16. Bundled Pricing (Tiered Pricing)

17. Pass Through vs. Bundled Pricing

18. Merchant Card Processing Fee Tips • There is nothing standard about processing fees • Pass-through pricing is usually the best option • Contract terms do not guarantee that rates will remain constant • Getting low rates is only the first step towards lowering credit card processing fees – keeping the rates low is the next step • Continual review of monthly statements is critical • Fees on returns should be refunded (pass-through pricing only) • You get what you negotiate!

19. PCI Compliance

20. PCI Data Security Standards (DSS) • Guidelines for businesses that accept credit/debit cards • To protect cardholder data when it is processed, stored or transmitted • Enforced by the payment card associations (VISA, MasterCard etc.)

21. VISA PCI Compliance Levels

22. PCI Terminology • Qualified Security Assessors (QSA) are data security firms that are qualified by the PCI Security Standards Council to perform on-site PCI DSS assessments. • Network Security Scans remotely checks an entity’s systems for vulnerabilities. For large merchants, PCI DSS requires network security scans on a quarterly basis. • Approved Scanning Vendors (ASV) are data security firms that use scanning solutions to determine whether or not a merchant meets the PCI DSS external vulnerability scanning requirement. • QSAs prepare the annual Report on Compliance (ROC), which documents detailed results from an entity’s PCI DSS assessment.

23. Common PCI DSS Violations • Storage of magnetic stripe data (never allowed) • Improperly installed merchant point-of-sale (POS) systems • Default system settings and passwords not changed • Poorly coded web applications that allow access to cardholder data through the web site • Missing and outdated security patches and updates • Lack of monitoring • Poorly implemented networks

24. Processor Approaches to PCI Compliance • Card Associations assess fees when non-compliance leads to a security issue or breach. • Processors often charge PCI non-compliance fees to merchants. • Merchant card processors have different approaches to validating PCI compliance • Require all businesses to validate PCI compliance. • Charge a fee for providing PCI support programs to help businesses become compliant. • Allow an organization to maintain its own in-house compliance validation programs This may be mandatory.

25. EMV (Chip and PIN) Cards • Fraud liability shifts in October 2015 • EMV technology requires two layers of security – the EMV “chip” along with a PIN or a signature. • EMV technology is not foolproof. • Three-pronged approach to data security should be used • EMV technology • Point-to-Point Encryption (P2PE) • Tokenization

26. Hardware and Technology

28. Types of Terminals Swipe and Sign Terminals Handheld and Wireless Terminals EMV Chip and PIN Terminals Near Field Communication (NFC) Terminals

29. Will the United States be Ready for the Shift? Credit Card Issuers • There are 1.2 billion payment cards in circulation in the U.S. • Only 20 million of those are EMV cards1 Merchant Card Terminal Suppliers • There are 12 million point-of-sale terminals in the U.S. • Only half of them are expected to be EMV ready by October 20151 Merchants / Vendors • Target alone has budgeted $100 million for its EMV rollout • The total card conversion cost in the U.S. is estimated to be $4.2 billion2 Source: www.EMVCo.com As of December 2014. Javelin Strategy & Research

30. Merchant Card Questions to Ask Transaction Classifications: • Are transactions are being categorized correctly so that they are qualifying for the best interchange rate? Customer Payments: • How can we encourage customers to choose lower-cost debit/PIN transactions as opposed to more expensive credit transactions? Services vs. Costs: • Are you receiving bundled or pass-through pricing? • Are the fees competitive? • Would a third-party processor be more cost effective? PCI Compliance: • What level of PCI compliance support does the bank provide? • What is the bank’s non-compliance fee? • How does the bank utilize encryption and tokenization to ensure data security?

31. Disclaimer This material is based on information obtained from sources generally believed to be reliable and available to the public, however PFM Asset Management LLC cannot guarantee its accuracy, completeness or suitability. This material is for general information purposes only and is not intended to provide specific advice or a specific recommendation.  All statements as to what will or may happen under certain circumstances are based on assumptions, some but not all of which are noted in the presentation. Assumptions may or may not be proven correct as actual events occur, and results may depend on events outside of your or our control.  Changes in assumptions may have a material effect on results. Past performance does not necessarily reflect and is not a guaranty of future results. The information contained in this presentation is not an offer to purchase or sell any securities.

32. Merchant Card Processing Overview Credit Card Association (Card Brand) – The company that creates the credit cards and set the rules. Issuing Bank – Financial institution that issues the cards to business and consumers Merchant – The organization that accepts a credit or debit card for payment. Acquiring Banks/Acquirers/Processors – Institutions that act as messengers between merchants and credit card associations. ISO – An independent sales organization; provides certain marketing or servicing functions. Member Bank – A bank that issues and/or processes merchant cards. Payment Gateway – Special portals that route transactions to an acquirer, usually in the case of an online shopping cart.